CVE-2023-23638

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions...

Deserialization of untrusted data

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions...

CVE-2023-23638 Apache Dubbo Deserialization Vulnerability Gadgets Bypass

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions...

CVE-2023-23638

Apache Dubbo CVE-2023-23638 describes a deserialization flaw during generic-invoke that enables remote code execution. Affected: Dubbo 2.7.x (≤2.7.21), 3.0.x (≤3.0.13), 3.1.x (≤3.1.5). Root cause: insecure deserialization in the generic invoke path. Impact: potential RCE with high impact to confi...

PT-2023-3056 · Apache · Apache Dubbo

Name of the Vulnerable Software and Affected Versions: Apache Dubbo versions 2.7.21 and prior versions Apache Dubbo versions 3.0.13 and prior versions Apache Dubbo versions 3.1.5 and prior versions Description: A deserialization vulnerability existed when dubbo generic invoke, which could lead to...

CVE-2023-26779

CleverStupidDog yf-exam v 1.8.0 is vulnerable to Deserialization which can lead to remote code execution RCE...

yf-exam 代码问题漏洞

yf-exam CloudFan Training and Exam System is a training and exam system for CleverStupidDog individual developers. A security vulnerability exists in CleverStupidDog yf-exam version 1.8.0, which stems from the presence of a deserialization vulnerability that can be exploited by an attacker to cau...

jackson-databind: use of deeply nested arrays

A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer.deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices...

jackson-databind: use of deeply nested arrays

A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer.deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices...

USN-5898-1 openjdk-8 vulnerabilities

It was discovered that the Serialization component of OpenJDK did not properly handle the deserialization of some CORBA objects. An attacker could possibly use this to bypass Java sandbox restrictions. CVE-2023-21830 Markus Loewe discovered that the Java Sound subsystem in OpenJDK did not properl...

Exploit for Deserialization of Untrusted Data in Oracle Weblogic_Server

CVE-2023-21839 Using this project to attack or test target...

LiteDB 代码问题漏洞

LiteDB is a .NET NoSQL document store in a single data file. A security vulnerability exists in LiteDB versions prior to 5.0.13 that stems from the use of a special field in a JSON document to convert to a different type from a POCO class, resulting in deserialization...

PT-2023-13560 · Hewlett Packard · Hpe Serviceguard Manager

Name of the Vulnerable Software and Affected Versions: Serviceguard Manager affected versions not specified Description: The issue is related to an unauthenticated Java deserialization vulnerability. Recommendations: At the moment, there is no information about a newer version that contains a fix...

JD-GUI 代码问题漏洞

JD-GUI is a Java Decompiler open source independent graphical utility . Displays the Java source code in a CLASS file. A security vulnerability exists in JD-GUI version 1.6.6, which originated when the program allowed an attacker to deserialize it via UIMainWindowPreferencesProvider.singleInstanc...

IBM Aspera Faspex Deserialization Vulnerability

IBM Aspera is an IBM FASP protocol-based fast file transfer and streaming solution from International Business Machines IBM. IBM Aspera Faspex version 4.4.2 Patch Level 1 and prior versions contain a deserialization vulnerability that stems from a YAML deserialization flaw. An attacker could use...

CVE-2022-47986 IBM Aspera Faspex code execution

IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. T...

CVE-2023-23836

SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to the SolarWinds Web Console to execute arbitrary commands...

CVE-2022-47504

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands...

SUSE CVE-2009-1103

Unspecified vulnerability in the Java Plug-in in Java SE Development Kit JDK and Java Runtime Environment JRE 5.0 Update 17 and earlier; 6 Update 12 and earlier; 1.4.219 and earlier; and 1.3.124 and earlier allows remote attackers to access files and execute arbitrary code via unknown vectors...

SUSE CVE-2013-7284

The PlRPC module, possibly 0.2020 and earlier, for Perl uses the Storable module, which allows remote attackers to execute arbitrary code via a crafted request, which is not properly handled when it is deserialized...